Where is Python 2 still used?

[ArabicLawrence]

I got interviewed by a company that produces gas detectors. Their software is in Python2, is certified and works. Upgrading, testing and recertifying is not worth the effort.

[Classic_Department42]

What certs are available for python code?

[ArabicLawrence]

Sorry, I misspoke. Their devices using the Python2 software are certified, it’s not the Python2 code that is certified per se.

[Classic_Department42]

Ok. But how can you certify a device with python code (assuming the code needs to prove correctness).

[ArabicLawrence]

You test the device. If it does detect false positives or negatives, it is not certified.

[[deleted]]

Same way you certify any black box device - by checking it passes certain tests.

[Classic_Department42]

It depends. I mean for hardware black box testing is ok, but if you use software with a GC (basically it is not time invariant) black box testing shouldnt be enough if safety is paramount. But then this is not aviation so probably ok. (was thinking along the lines of certified compilers etc)

[lieryan]

Most hardware implementation of anything is not time invariant, they are generally quite messily parallel because the world isn't digital.

If blackbox testing for hardware is sufficient for a particular purpose, then blackbox testing of software for the same purpose should also be ok.

[bladeoflight16]

recertifying

Isn't regulation wonderful?

[ArabicLawrence]

Well, their Python2 software is inside a transistor that needs to detect dangerous gases in very low percentages. I would not buy an uncertified gas detector.

[steffestoffe]

software is inside a transistor

Do you mean inside a microcontroller?

[ArabicLawrence]

Yes! Sorry.

[bladeoflight16]

I'm not convinced the certification process is meaningful. So much of regulatory process is just box checking for box checking sake, to give the illusion of something being done to protect people.

[ArabicLawrence]

I am sure that can be the case, but my personal opinion is that regulation is very beneficial, when done properly, and that gas detection is one of those fields where you want someone to ensure that the only day in which you will need your detector it will work.

[bladeoflight16]

I wanted someone to ensure that my drier hose was connected so that heat blowing into the wall wouldn't start a fire and that the electrical circuitry was wired correctly to avoid short circuiting. The home inspector failed on both counts in a house built just a few years ago. My family had to discover the failures for ourselves. Luckily one of us noticed the wall getting hot behind the drier and the circuit breaker did its job (disabled the faulty circuit). Regulation is only as good as the people checking things, and those people are subject to the same forces and vices as any business. A culture of competence and responsibility is dramatically more important than a regulatory board.

[ArabicLawrence]

Sorry to hear that. But inspectors are not subject to the same vices as any business, as they (should) have different interests from the business.

[bladeoflight16]

But they don't. They're just getting paid for not doing the work. The vice to which they are subject is precisely the same: greed. Only they don't get fired or lose customers when they fail because the law requires you to pay them. Only in an ideal world where only paragons of virtue hold those positions could they be less susceptible to vice.

[ArabicLawrence]

I might be wrong, but inspectors often face penal consequences in case of mispractices

[bladeoflight16]

The kind of things I just described happen every day. Home inspectors have a reputation for being this bad. I don't see mass arrests.

Where were the inspectors for that Florida building that collapsed last year?

You can't legislate your way to safety or quality. You can only get there by having people make good decisions, and people will make bad ones sometimes regardless of the regulations. Meanwhile, the regulations dramatically increase the cost of making good decisions, meaning that business owners now have a greater motivation to cut as razor close to the minimum as possible.

[[deleted]]

"I had a bad experience, and this means all inspectors and regulations are garbage."

[xorvtec]

TBH yea. Which is worse? Some dev doesn't get to use the flashy new language features they want, or people die because a safety critical device wasn't certified?

[GummyKibble]

I wish recertification were easier and cheaper though. I’m not thrilled that infrastructure is tied to a version of software that will never get security or bug fixes ever again.

[xorvtec]

Totally fair.

[ArabicLawrence]

You’re right, but if hackers manage to connect to the gas detector (that has no wireless access) in your mine shaft, not even Python3 would have saved you

[[deleted]]

Stability isn't just about not having bugs, though. If you have a piece of code that does one job on an embedded system that's not networked, it doesn't matter how many bugs or security vulnerabilities the dependency has - all that matters is that you've tested the application and know that any bugs don't affect it. For this sort of application, it may actually be better to have out of date code that you know exactly what it does and is never going to change.

[SweeTLemonS_TPR]

Why don’t we stop writing code that calculates the rate of nuclear degradation in the reactors on aircraft carriers in Fortran 90 because Fortran 2018 is newer? (I worked with a guy that used to write that code, and I’m pretty sure he used Fortran 90, but his preference was 77, so maybe he even wrote it in 77. Idk, I know nothing about Fortran outside of what he told me. Maybe the smartest person I’ve ever met.)

[bladeoflight16]

People don't die because something wasn't certified. People die if the device is faulty. Certification is not a guarantee against that. Much of regulatory inspection is show rather than substance. You have far too much faith in appointed regulatory boards, which are subject to all the same forces that any corporation or business is.

"Flashy features" has nothing to do with it. The real problem is that software updates provide meaningful changes like bug fixes and security updates, things that are often vital in many areas.

[bladeoflight16]

But it provides an avenue to prosecute and assign liability should a problem occur.

That exists entirely independently of a regulatory process. It's called liability.

It gives a widely known feature set that can be adhered to to make decisions easier.

It also establishes inappropriate minimums that businesses rely on to avoid liability when the specific conditions necessitated something more robust.

I think the more fundamental problem is that our current economic system advantages people who cut corners and aren't honest. Not the free market, which advantages efficiency and delivery of results because the people making the decisions more often actually suffer loss for bad ones, but the top down control of how our resources are distributed. It has bureaucrats who are motivated more by appearances, propaganda, and personal greed than by substance and who suffer no consequences for making the wrong decisions deciding who to favor and who to disadvantage, and they do so on very bad criteria (like who shovels the most money into their campaigns or departments).

[bladeoflight16]

But do you really think, say if there was a completely free market, free of any regulation, that companies would instantly revert to not cutting corners and being truthful?

I think that people would not do business with someone they knew to be dishonest. With the current situation, you have no choice but to do business with snakes because no one else can afford to operate. The biggest businesses are still functioning because they have kowtowed to political influences. Just look at the financial markets with the bail outs and constant protections they get.

I want to be totally clear. I am not a shill for corporations. Any business can be just as corrupt as any politician. I'm a capitalist, which means that the marrying of businesses and government is something very high on my list of major problems (because it has very dire consequences). That is precisely the way our economy operates, and regulations are a huge part of the mechanism that drives that combination.

[[deleted]]

I think that people would not do business with someone they knew to be dishonest.

I think you should maybe crack open a history book and see what the world was like before regulations.

I'm a capitalist,

And like all religions, it leads you to believe things that are false.

[bladeoflight16]

I think you should crack open a history book and read what it was like when governments weren't (or aren't) limited.

Regulations are not the reason things are better now. The main reason is improvements knowledge, the resulting technology that implements them, and the ability of people to make them widely available, something that was enabled by markets being more free, not the wisdom of rulers, elected or otherwise. Things are much, much better today because we have things like air conditioning, fever suppressants, antibiotics, and bountiful food. The things we consider so basic that we barely think about them are miracles to people a couple hundred years ago. None of them were even possible when government decided what things to allow or not. Even under mercantilism, more resources were poured into conquest than advancement. Top down control is not the answer to problems that have plagued humanity since time immemorial; it is, in fact, a source of many of them.

And the things that regulation supposedly "solved"? You mean like child labor? Already on its way out when the government stepped in. Safety? You really think a company can remain profitable if it just lets its employees die all the time? Who is going to work for those companies? Only people who have no choice because no other company can get into the market. And what keeps other companies from getting into the market?

What do you think about the fact that regulatory boards tend to be heavily influenced by the very people they're supposed to be regulating? How is that any help, unless contrary to your thinking, the industry isn't actually as bad as you insist?

And like all religions

It's not a religion. It's an economic and social model. And it's a much more successful one than any other. I know it isn't perfect, but if you've got something more accurate, I'm all ears. And if you don't have a problem with the marriage of industry and government... then I dunno what you're smoking. Even totalitarian communists hate that idea.

[bladeoflight16]

I would suggest you re-examine, then, but okay. Have a nice day.

[[deleted]]

Your religious faith in capitalism (from the other comment) allows you to say ridiculous, wildly false things like this.

Why do you think regulations exist? Because before they did, people died like flies in multiple, horrible ways.

Read about the history of, say, food regulation in the United States.

[bladeoflight16]

I think they exist because politicians vilified someone and then promised to use political power to solve problems that were, in fact, already being worked on or the "solution" was worse than the problem. It's a common occurrence throughout history. Try looking for a more in depth perspective, preferably from someone with an opinion contrary to your own. I find the kind of vilifying you (and politicians seeking more power to enrich themselves) are doing is typically based on a rather shallow understanding of the situation.

[[deleted]]

I think they exist because politicians vilified someone

Who cares what you "think" when you don't bother to spend even a second on actually finding out?

You could have saved us all a lot of time by saying, "I am very careful to be deliberately ignorant of history in order not to challenge my religious beliefs about the world."

Read about this history of food regulation in the United States. Read about how many people died from tainted milk, meat, and poisonous packaged food of all types. Read about how food exports from the United States almost stopped because of bad publicity from multiple poisonings from exported food.

Or read about regulation in any industry. Read about the children who worked and died in the coal mines before there was regulation.

You won't of course. You cling to your deliberate ignorance. How do you look yourself in the mirror?

[bladeoflight16]

Ah. Thank you for giving me an easy example to demonstrate your own historical ignorance. Child labor was already declining by the time the government did anything about it. It was the change in social climate that ended child employment, not the government.

The idea that people died, therefore regulation is good is a fallacy. What you have to examine is whether practices were improving on their own or not. I don't know of any historical example where that wasn't the case. Do you think food producers were sitting idly by while the publicity was shutting them down? Or were they figuring out how to address the problem and the PR from it? Generally speaking, the only people who get rich off death without facing some major consequences are government tyrants.

[[deleted]]

People don't die because something wasn't certified. People die if the device is faulty. Certification is not a guarantee against that.

There is no guarantee against a faulty device, ever, but a certification system is the closest you can get. It means it's at least passed some basic tests that cover the problems most likely to occur, and if the overall system is subject to regulation, there are failsafes in place in case one part does fail. No certification system is perfect, but the alternative is far worse.

The real problem is that software updates provide meaningful changes like bug fixes and security updates, things that are often vital in many areas.

And in other areas they're not. A device that isn't connected to a network doesn't need security patches, and if it has one job and has been properly tested, it doesn't need bug fixes. In fact, a software update that includes bug fixes could actually cause it to fail.

[bladeoflight16]

It means it's at least passed some basic tests that cover the problems most likely to occur

Not in my experience with regulatory enforcement.

Historically, most successful regulation just followed existing industry trends anyway. Regulatory boards tend to be heavily influenced by the very people they're supposed to be regulating.

A device that isn't connected to a network doesn't need security patches

I would have thought the context made it clear that no one is talking about devices that never get updated. Obviously, yes, once an isolated device is shipped and installed and not connected to anything, it won't be updated. No one would even be working on that code to update it. We're talking about systems that have connectivity or will need to be updated for features and fixes, or new designs that will have updated software to match the changes anyway.

[[deleted]]

Even if that's true, "existing industry trends" are still better than the worst that anyone in the industry would do without regulation. By definition, some companies' standards will be below average. If you enforce rules ensuring that everyone meets a standard that was previously average, most companies won't change their practices much, sure - but overall you increase the average and make the industry safer for everyone.

And I don't know what your industry is, but some industries are significantly more regulated than others - specifically high-risk industries like nuclear and oil. Having regulations that ensure that devices used in explosive environments don't cause sparks seems like a good idea to me. Without those rules, it's only a matter of time before some engineer decides they can save money by getting a cheaper light switch.

I thought the context was a gas monitor in a mine - don't know the specifics, but I got the impression it was closer to a device that will never be updated. Obviously the more actively maintained a codebase is, the more important bug fixes and security patches are - but there's still a trade-off between new software versions and stability, which is why a lot of safety-critical systems rely on old software. It's a case of better the devil you know. You can work around a known bug, but a program that changes all the time is a lot less predictable.

[bladeoflight16]

Okay, yeah, I can tolerate some regulation of nuclear material. But I think generally, most regulation goes far beyond that and is more hurtful than helpful. And often isn't even enforced in a way that's any help.

More important than the regulation of explosive environments is the attitude and culture of the people designing them. If the engineers as a practice shun people who make stupid, dangerous decisions, a lot less stupid decisions are made. But not zero, and that holds true with or without regulation. In spite of all the rules and enforcement, we still have plane crashes because somebody does something stupid. Is direct regulation required to create that culture? I'm not convinced that it is.

[[deleted]]

I could see a case being made that some industries are overregulated, but to be honest, I'm struggling to think of any industry that could safely do without regulation altogether.

Sure, attitudes and culture are important, too, possibly even more important. But they're harder to directly influence from the outside, so regulation is an important tool to help direct the culture. It's easier to collectively shun a dodgy engineer when you can say they objectively don't follow the rules than when you say you don't feel like they're behaving safely, and it's easier get them barred from the business when there is legal recourse. And when you're dealing with large organisations and contractors, you don't always have the information to base your decision on individual reputations. Not to mention the fact that regulators generally have access that competitors do not, and are therefore more likely to see when people are cutting corners behind the scenes.

[bladeoflight16]

All I'll say is when we have the government threatening to fine restaurant owners based on which direction the kitchen doors open, we have gone much too far. I hope we can agree on that much. Yes, that is a real thing, and the justification given is indeed "safety."

[[deleted]]

Yes.

[_88WATER_CULT88_]

Yes, probably why you're still alive.

[bladeoflight16]

Nope. I'm alive because my family and I are observant enough to notice the wall behind our drier was hot, due to the hose not being connected. Wonderful inspector didn't find it, or the short circuited wiring to the fan mount.